Cryptographic protection of information in a processing system

Abstract

A processor employs a hardware encryption module in the processor's memory access path to cryptographically isolate secure information. In some embodiments, the encryption module is located at a memory controller (e.g. northbridge) of the processor, and each memory access provided to the memory controller indicates whether the access is a secure memory access, indicating the data associated with the memory access is designated for cryptographic protection, or a non-secure memory access. For secure memory accesses, the encryption module performs encryption (for write accesses) or decryption (for read accesses) of the data associated with the memory access.

Description

BACKGROUND[0001]1. Field of the Disclosure[0002]The present disclosure relates generally to processors and more particularly to information security at a processor.[0003]2. Description of the Related Art[0004]In many processor applications, protection of information security is an important feature. For example, a processor can be used in a server in an Infrastructure As A Service (IAAS) environment, wherein the processor executes one or more virtual machines (VMs) and executes a hypervisor to partition the server hardware among the VMs and isolate the VMs from each other. Because different VMs may be executed on behalf of different customers, it is desirable that the information (instructions and data) employed by each VM be protected from access by other VMs. Conventionally, the hypervisor maintains isolation of VM information by maintaining separate memory page tables and other logical entities for each VM. However, flaws (e.g. bugs) in the hypervisor can cause the hypervisor its...

AI Technical Summary

Benefits of technology

This patent describes a technique to protect information in a processing system where different virtual machines are executed. Normally, a hypervisor is used to isolate the VMs by assigning them separate memory resources to prevent them from accessing each other's information. However, this can be vulnerable to bugs or malicious modification of the hypervisor. The patent proposes using encryption techniques to protect the information of each VM from access by the hypervisor or other VMs. This prevents unauthorized access to information and ensures that only authorized users can understand or interpret it.

Problems solved by technology

However, flaws (e.g. bugs) in the hypervisor can cause the hypervisor itself to be vulnerable to exploitation, allowing one VM to access the information of another VM.

Even in more private security environments, such as a personal computer, data stored in memory modules can be subject to theft, and the data stored therein subject to unauthorized access.

Images